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Description 

TECHNICAL FIELD OF THE INVENTION 

[0001] This invention is related in general to the field 
of telecommunications systems. More particularly, the 
invention is related to a lawful interception device for 
media streams, in particular VoIP calls in IP based net- 
works. 

BACKGROUND OF THE INVENTION 

[0002] Current lawful interceptions are deployed in 
class4/class5 switches of PSTN/PLMN networks. In 3G/ 
UMTS or next generation networks, a connection may 
be IP end to end. No traffics will go through class 
5/class4 switches. That means current lawful intercep- 
tion solutions cannot be used here. One solution may 
undertake an analysis of IP packets in a related network 
node, but it's difficult to know which route a call (media 
stream) will take through the network. 
[0003] In Thernelius F: "SIP, NAT, and Firewalls' Mas- 
ter's Thesis, Kungst Tekniska Hoegskolan, Department 
of Teleinformatics-Ericsson, May 200 (2000-05), a 
method for performing SIP signalling for a mediastream 
is disclosed. The method includes receiving a SIP invite 
message of a first IP party, adapting at least one con- 
nection parameter in the SDP of the received SIP invite 
message, transmitting the adapted SIP invite message 
to a second IP party, receiving a SIP response message 
from the second IP party, adapting at least one connec- 
tion parameter in the SDP of the received SIP response 
message, and transmitting the adpated SIP response 
message to the first IP party. 

[0004] In WO 02 15627 A a method for providing a 
mode selection procedure is disclosed. A network ele- 
ment is adapted to perform a mode selection procedure 
for selecting the same mode for bidirectional communi- 
cation between the network elements. The mode selec- 
tion ensures the use of one and the same mode in uplink 
and downlink direction and thus enables e.g. IP teleph- 
ony in UMTS using SIP protocol. 
[0005] In EP-A-1 111 1 892 a method for IP network 
surveillance is disclosed. An authentication server as- 
sociated with an end user device determines whether 
the end user device is under surveillance. In case of sur- 
veillance the authentication server notifies a proxy serv- 
er which copies call signaling information, extracts me- 
dia stream identification and decoding information 
thereof and forwards it to an edge router which copies 
the media stream of the end user. 
[0006] In WO 01 89145 A a method of monitoring calls 
with a mobile terminal in an IP-based network is dis- 
closed. Whem the mobile terminal sends an Admission 
Request message to the Gatekeeper, the Gatekeeper 
sends a query the Monitoring Station asking whether the 
mobile terminal is to be monitored. The Monitoring Sta- 
tion sends a reply to the Gatekeeper indicating that the 



mobile station is to be monitored and provides an IP ad- 
dress where monitored packets are to be sent. The 
Gatekeeper then sends a monitoring request message 
to the access router associated with the mobile terminal. 
5 The request identifies the mobile terminal to be moni- 
tored, instructs the access router to monitor the mobile 
station, and provides a unique call identification and the 
IP address where monitored packets are to be sent. 
When the access router detects a packet associated 
10 with the mobile station, the router sends all packets as- 
sociated with the mobile terminal to the Monitoring Sta- 
tion. 

SUMMARY OF THE INVENTION 

15 

[0007] It is an object of the invention to provide a law- 
ful interception device for VoIP calls in IP based net- 
works. 

[0008] The inventive lawful interception device de- 
20 tects information in the signalling information being 
transmitted between two IP parties and generates in- 
structions out of the detected signalling information for 
instructing a RTP (Real-time Transport Protocol) proxy 
server to create channels to bypass a VoIP call to be 
25 intercepted via an intermediate storage medium. In- 
stead of voice each media stream could be intercepted, 
e.g. data, internet access, e-mail, video, real-time pic- 
tures, etc. 

[0009] In a SIP (Session Initiation Protocol) intercep- 
30 tion proxy server, where interception should be control- 
led, applications for interception are running to chose 
calls for interception. If a call should be monitored, the 
SIP proxy server has first to hold the invite message 
from A party. There are listening information in SDP 
35 (session description protocol) part of invite message. 
[0010] SIP proxy server then instructs a RTP proxy 
server via a RTP proxy control interface to allocate a 
bypass channel for monitoring the media stream (A 
channel: sending to A party). The RTP information of 
40 this bypass channel (listening part: ip and port) is includ- 
ed in SDP part in the SIP invite message and passed to 
its destination. 

[0011] When SIP proxy server has received a re- 
sponse of B party, he instructs RTP proxy via RTP proxy 

45 control interface to allocate another bypass channel for 
monitoring the media stream (B channel: sending to B 
party). The RTP information of this second bypass chan- 
nel (listening part: ip and port) is included in SDP part 
in SIP ok message and send to its origination (A party). 

so [0012] After session setup, both parties will start RTP 
connections to RTP proxy server depending on connec- 
tion parameters in its received SIP messages. But those 
are transparent to A and B. They do not know they are 
connected to a RTP proxy. 

55 [0013] The RTP proxy can start record both media 
channels (A and B). At the end of this call, e.g. a media 
file with two sound tracks will be created by RTP proxy. 
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Advantages: 
[0014] 

centralized network node to intercept media 
streams, 

low cost of deployment, 
transparent to end users, 

the RTP proxy can also be used in the same way 
as above in a media gateway control (MEGACO, H. 
248) based network or H.323 network. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0015] For a better understanding of the present in- 
vention, reference is made to the accompanying draw- 
ings, in which: 

FIG. 1 is a simplified block diagram of a portion of an 
exemplary telecommunications network ac- 
cording to the teachings of the prior art; 

FIG. 2 is a simplified block diagram of a portion of an 
exemplary telecommunications network ac- 
cording to the teachings of the present inven- 
tion. 

DETAILED DESCRIPTION OF THE INVENTION 

[0016] FIG. 1 shows a portion of an exemplary tele- 
communications network according to the teachings of 
the prior art. 

[0017] Two IP parties, e.g. yshen@ alcatel.de and 
eric@alcatel.com, are interconnected via two networks: 
a SIP signaling network and a transmission network. Via 
the SIP signaling network signaling is performed, e.g. a 
connection is established between the two IP parties. 
Via the transmission network the information to be trans- 
mitted, e.g. voice, data, etc. is transmitted in media 
streams (RTP session). 

[0018] In the SIP based network, each SIP proxy serv- 
er is responsible for signaling and session monitoring. 
The media stream will go from one IP endpoint to an- 
other IP endpoint. There is no need of a centralized me- 
dia path like in PSTN network. A lawful interception of 
media stream could be done only in the network layer. 
[001 9] Recording media stream by analyzing network 
traffics for lawful interception is very expensive, due to 
the packet route through the IP network could change. 
Therefor the recording could only be done very closely 
to the endpoints. Additionaly a resembling of recorded 
packets is needed. A playing in real time will be difficult. 
[0020] In the following definition and background in- 
formation is provided regarding SIP, proxy server, RTP, 
SDP, etc. 



SIP: 

[0021] The Session Initiation Protocol (SIP) is an ap- 
plication-layer control (signaling) protocol for creating, 

5 modifying and terminating sessions with one or more 
participants. These sessions include Internet multime- 
dia conferences, Internet telephone calls and multime- 
diadistribution. Members in asession can communicate 
via multicast or via a mesh of unicast relations, or a com- 

10 bination of these. 

[0022] SIP invitations used to create sessions carry 
session descriptions which allow participants to agree 
on a set of compatible media types. SIP supports user 
mobility by proxying and redirecting requests to the us- 

15 er's current location. Users can register their current lo- 
cation. SIP is not tied to any particular conference con- 
trol protocol. SIP is designed to be independent of the 
lower-layer transport protocol and can be extended with 
additional capabilities. 

20 [0023] The Session Initiation Protocol (SIP) is an ap- 
plication-layer control protocol that can establish, mod- 
ify and terminate multimedia sessions or calls. These 
multimedia sessions include multimedia conferences, 
distance learning, Internet telephony and similar appli- 
es cations. SIP can invite both persons and "robots", such 
as a mediastorage service. SIP can invite parties to both 
unicast and multicast sessions; the initiator does not 
necessarily have to be a member of the session to which 
it is inviting. Media and participants can be added to an 

30 existing session. 

[0024] SIP can be used to initiate sessions as well as 
invite members to sessions that have been advertised 
and established by other means. Sessions can be ad- 
vertised using multicast protocols such as electronic 

35 mail, news groups, web pages or directories (LDAP), 
among others. 

[0025] SIP transparently supports name mapping and 
redirection services, allowing the implementation of IS- 
DN and Intelligent Network telephony subscriber serv- 

40 ices. These facilities also enable personal mobility. In 
the parlance of telecommunications intelligent network 
services, this is defined as: "Personal mobility is the abil- 
ity of end users to originate and receive calls and access 
subscribed telecommunication services on any terminal 

45 in any location, and the ability of the network to identify 
end users as they move. Personal mobility is based on 
the use of a unique personal identity (i.e., personal 
number)." Personal mobility complements terminal mo- 
bility, i.e., the ability to maintain communications when 

50 moving a single end system from one subnet to another. 
[0026] SIP supports five facets of establishing and ter- 
minating multimedia communications: 

User location: determination of the end system to 
55 be used for communication; 

User capabilities: determination of the media and 
media parameters to be used; 
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User availability: determination of the willingness of 
the called party to engage in communications; 

Call setup: "ringing", establishment of call parame- 
ters at both called and calling party; 

Call handling: including transfer and termination of 
calls. 

[0027] SIP can also initiate multi-party calls using a 
multipoint control unit (MCU) or fully-meshed intercon- 
nection instead of multicast. Internet telephony gate- 
ways that connect Public Switched Telephone Network 
(PSTN) parties can also use SIP to set up calls between 
them. 

[0028] SI P is designed as part of the overall I ETF mul- 
timedia data and control architecture currently incorpo- 
rating protocols such as the real-time transport protocol 
(RTP) for transporting real-time data and providing QoS 
feedback. 

[0029] A request and a response form together a 
transaction. SIP uses e.g. invite and ack messages to 
build up connections. Other messages used are e.g. ok, 
bye, options, register, cancel. SIP parties are identified 
via a SIP-ULR, e.g.: sip:clientname@hostaddress. 
Each client may transmit requests to a proxy server or 
directly to an IP address. 

[0030] An establishment of a connection is perfomed 
is three steps: sending an invite (request) message from 
a first IP party to a second IP party, sending an ok (re- 
sponse) message from the second IP party to the first 
IP party, sending an ack (response) message from the 
frist IP party to the second IP party. The invite message 
includes as much information as needed to allow the 
second IP party to judge whether a connection is wanted 
or not. The ack message is an acknowledgement, which 
serves to increase savety of the connection. SIP is thus 
not dependent on TCP or UDR 

[0031] The SIP according to the invention is the SIP 
currently standardized and modifications thereof and 
equivalents thereof. 

RTP: 

[0032] The Audio/Video Transport Working Group of 
IETF was formed to specify a protocol for real-time 
transmission of audio and video over UDP and IP mul- 
ticast. This is the Real-time Transport Protocol, RTP, to- 
gether with its associated profile for audio/video confer- 
ences and payload format documents. The payload for- 
mats currently under discussion include a number of 
media specific formats (MPEG-4, DTMF, PureVoice) 
and FEC techniques applicable to multiple formats (par- 
ity FEC, Reed-Solomon coding). RTP is used to replace 
a normal circuit-switched trunk between two nodes. 
[0033] The real-time transport protocol (RTP) is a 
payload format to be used for e.g. Adaptive Multi-Rate 
(AMR) and Adaptive Multi-Rate Wideband (AMR-WB) 



encoded speech signals. RTP provides end-to-end net- 
work transport functions suitable for applications trans- 
mitting real-time data, such as audio, video or simulation 
data, over multicast or unicast network services. RTP 
5 does not address resource reservation and does not 
guarantee quality-of service for real-time services. The 
data transport is e.g. augmented by the control protocol 
RTCP (Real-time Transport Control Protocol) to allow 
monitoring of the data delivery in a manner scalable to 
10 large multicast networks, and to provide minimal control 
and identification functionality. RTP and RTCP are de- 
signed to be independent of the underlying transport 
and network layers. The protocol supports the use of 
RTP-level translators and mixers. The data transported 
15 by RTP in a packet, for example audio samples or com- 
pressed video data. A data packet includes e.g. the fixed 
RTP header, a possibly empty list of contributing sourc- 
es, and the payload data. 

[0034] The RTP according to the invention is the RTP 
20 currently under discussion and modifications thereof 
and equivalents thereof. RTP may be a protocol for both 
audio and video, or audio only, or video only, or audio, 
video and data, or audio and data, etc. One modification 
of RTP is e.g. RTP/I, an application level real-time pro- 
25 tocol for distributed interactive media. Typical examples 
of distributed interactive media are shared whiteboards, 
networked computer games and distributed virtual en- 
vironments. RTP/I defines a standardized framing for 
the transmission of data and provides mechanisms that 
30 are universally needed for this media class. Thereby 
RTP/I enables the development of reusable functionality 
and generic services that can be employed for multiple 
distributed interactive media. Examples for this kind of 
functionality are the ability to record sessions, to support 
35 late coming participants, and to provide security servic- 
es. RTP/I is a protocol that follows the ideas of applica- 
tion level framing and integrated layer processing. It has 
been designed to be independent of the underlying net- 
work and transport layers. Thus RTP/I as a modified 
40 RTP protocol that reuses many aspects of RTP while it 
is thoroughly adapted to the specific needs of distributed 
interactive media. 

Proxy, proxy server: 

45 

[0035] An intermediary program that acts as both a 
server and a client for the purpose of making requests 
on behalf of other clients. Requests are serviced inter- 
nally or by passing them on, possibly after translation, 
50 to other servers. A proxy interprets, and, if necessary, 
rewrites a request message before forwarding it. 

Server: 

55 [0036] A server is an application program that accepts 
requests in order to service requests and sends back 
responses to those requests. Servers are either proxy, 
redirect or user agent servers or registrars. 
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User agent client (UAC), calling user agent: 

[0037] A user agent client is a client application that 
initiates the SIP request. 

SDP: 

[0038] The Session Description Protocol (SDP) is in- 
tended for describing multimedia sessions for the pur- 
poses of session announcement, session invitation, and 
other forms of multimedia session initiation. 
[0039] The purpose of SDP is to convey information 
about mediastreams in multimediasessionstoallowthe 
recipients of a session description to participate in the 
session. SDP is primarily intended for use in an inter- 
network, although it is sufficiently general that it can de- 
scribe conferences in other network environments. 
[0040] A multimedia session, for these purposes, is 
defined as a set of media streams that exist for some 
duration of time. Mediastreams can be many-to-many. 
The times during which the session is active need not 
be continuous. 

[0041] Thus far, multicast based sessions on the In- 
ternet have differed from many other forms of confer- 
encing in that anyone receiving the traffic can join the 
session (unless the session traffic is encrypted). In such 
an environment, SDP serves two primary purposes. It 
is a means to communicate the existence of a session, 
and is a means to convey sufficient information to ena- 
ble joining and participating in the session. In a unicast 
environment, only the latter purpose is likely to be rele- 
vant. 

[0042] Thus SDP includes: 

o Session name and purpose 
o Time(s) the session is active 
o The media comprising the session 
o Information to receive those media (addresses, 
ports, formats and so on) 

[0043] As resources necessary to participate in a ses- 
sion may be limited, some additional information may 
also be desirable: 

o Information about the bandwidth to be used by the 
conference 

o Contact information for the person responsible for 
the session 

[0044] In general, SDP must convey sufficient infor- 
mation to be able to join a session (with the possible 
exception of encryption keys) and to announce the re- 
sources to be used to non-participants that may need to 
know. 

[0045] SDP includes: 

o The type of media (video, audio, etc) 

o The transport protocol (RTP/U DP/IP, H.320, etc) 



o The format of the media (H. 261 video, MPEG video, 
etc) 

[0046] For an IP multicast session, the following are 
5 also conveyed: 

o Multicast address for media 
o Transport Port for media 

w [0047] This address and port are the destination ad- 
dress and destination port of the multicast stream, 
whether being sent, received, or both. 
[0048] For an IP unicast session, the following are 
conveyed: 

15 

o Remote address for media 

o Transport port for contact address 

[0049] The semantics of this address and port depend 
20 on the media and transport protocol defined. By default, 
this is the remote address and remote port to which data 
is sent, and the remote address and local port on which 
to receive data. However, some media may define to 
use these to establish a control channel for the actual 
25 media flow. 

[0050] The SDP according to the invention is the SDP 
currently standardized and modifications thereof and 
equivalents thereof. 

[0051] FIG. 2 shows a portion of an exemplary tele- 
30 communications network according to the teachings of 
the present invention. 

[0052] Like in fig. 1 two IP parties, e.g. yshen@alcatel. 
de and eric@alcatel.com, are interconnected via two 
networks: a SIP signaling network and a transmission 

35 network. Via the SIP signaling network signaling is per- 
formed, e.g. a connection is established between the 
two IP parties. Via the transmission network the infor- 
mation to be transmitted, e.g. voice, data, etc. is trans- 
mitted in media streams (RTP session). 

40 [0053] Different from fig. 1 a lawful interception device 
is included in fig. 2. The lawful interception device is e. 
g. a processor with particular software. The processor 
is e.g. a digital signal processor, a controller, a micro- 
processor or the like. Instead of one processor two or 

45 more processors could be used. Two or more proces- 
sors could be located at different sites. One processor 
could be used to perform SIP proxy server operations 
and another processor could be used to perform RTP 
proxy server operations. In general, one, two or more 

50 hardwares could be used to run one, two, or more soft- 
wares. Each software could in addition be run in parts 
on different hardware. 

[0054] The lawful interception device includes a SIP 
(Session Initiation Protocol) proxy server or a MGC (Me- 
55 dia Gateway Controller) to detect information in the sig- 
nalling information being transmitted between two IP (In- 
ternet Protocol) parties and to generate instructions out 
of the detected signalling information for instructing a 
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RTP (Real-time Transport Protocol) proxy server to cre- 
ate channels to bypass a media stream to be intercepted 
via an intermediate storage medium. Media streams are 
e.g. VoIP, data, internet access, e-mail, video, real-time 
pictures, music, video clips, video games, etc. The stor- 
age medium could be a compact disk, a magnetic stor- 
age medium, a read access memory, or the like. 
[0055] The method for performing SIP signaling for a 
media stream includes the following steps: 

receiving a SIP invite message of a first IP party, 

adapting at least one connection parameter in the 
SDP (Session Description Protocol) of the received 
SIP invite message, 

transmitting the adapted SIP invite message to a 
second IP party, 

receiving a SIP response message of the seond IP 
party, 

adapting at least one connection parameter in the 
SDP (Session Description Protocol) of the received 
SIP response message, 

transmitting the adapted SIP response message to 
the first IP party. 

[0056] At least one RTP parameter includes informa- 
tion about a bypass channel, an address, or a port. The 
RTP parameters sent to both IP parties differ from each 
other. 

[0057] After receipt of the SIP invite message of the 
first IP party the SIP interception proxy server sends a 
request to the RTP interception proxy server to assign 
at least two channels for bothway communication. The 
interface used to communicate between SIP intercep- 
tion proxy server and RTP interception proxy server is 
a XML based API. The number of channels to be as- 
signed may vary dependent of the amount of data to be 
transmitted, of the bandwith requested, of the quality of 
service requested, of the kind of information to be trans- 
mitted, e.g. voice, voice and data, voice and video, etc. 
At least one channel is assigned to transmit information 
between the RTP interception proxy server and the ter- 
minal of the first IP party. The terminal could be a phone, 
a laptop, a personal computer, a screenphone, a mobile 
phone, etc. At least one other channel is assigned to 
transmit information between the RTP interception 
proxy server and the terminal of the second IP party. 
[0058] Assume channel A at the RTP interception 
proxy server is assigned to transmit information be- 
tween the second I P terminal and the terminal of the first 
IP party, and channel B is assigned to transmit informa- 
tion between the the terminal of the first IP party and the 
second IP terminal. Then the RTP interception proxy 
server sends information about the assignment of chan- 



nels A and B to the SIP interception proxy server. The 
SIP interception proxy server includes information about 
channel A in the invite message to be send to the second 
IP party. The information about channel A is advanta- 
5 geously included in the connection parameter informa- 
tion to be included in the SDP of the SI P invite message. 
[0059] After receipt of the SIP response message of 
the seond IP party, which corresponds to an ok message 
stating that a connection to the first IP party is desired, 
the SIP interception proxy server exchanges the con- 
nection parameter included in the SDP part of the ok 
message by the information about channel B. The mod- 
ified ok message including the information about chan- 
nel B is send to the first IP party. 
[0060] Thus the first IP party will send data to channel 
B and receive data via channel A of the RTP interception 
proxy server. The second I P party will send data to chan- 
nel A and receive data via channel B of the RTP inter- 
ception proxy server. Within the lawful interception de- 
vice the intermediate storage medium is connected to 
both channel A and B. Thus the information flow be- 
tween both IP parties will transfer the intermediate stor- 
age medium and thus interception is enabled. The first 
party is not aware on which channel the second party is 
sending, and the second party is not aware on which 
channel the first party is sending. Thus interception is 
transparent regarding the two IP parties. 
[0061] A computer program for performing at least 
part of the steps of the inventive method could be used 
as an upgrade software, which is sold e.g. to service 
providers, which will upgrade one or more SIP proxy 
server thus enabling a usual SIP proxy server having 
the functionality of an SIP interception proxy server. The 
computer program includes at least the following steps: 

adapting at least one connection parameter in the 
SDP (Session Description Protocol) of the received 
SIP invite message, 

adapting at least one connection parameter in the 
SDP (Session Description Protocol) of the received 
SIP response message. 

[0062] The computer program could also be pro- 
grammed to perform all steps of the method as de- 
scribed above. 

[0063] Within an IP network one, two, or more SIP 
proxy servers could be used, one, two, or more SIP in- 
terception proxy servers could be used, one, two, or 
more RTP proxy servers could be used, and one, two, 
or more RTP interception proxy servers could be used. 
[0064] The IP network could be a wireline network, a 
wireless network, or a combination of both. 
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List of abbreviations: 




Teilnehmern ubertragenen Zeichengabenachricht 








zu erfassen, und 


[0065] 






dadurch gekennzeichnet ist, dass er bzw. sie ge- 
eignet ist, aus der erfassten Zeichengabeinformati- 


3G 


Third Generation 


5 


on Anweisungen fur einen Echtzeit-Transportproto- 


API 


Application Programmer Interface 




koll-Proxy-Server zu erzeugen, Kanale fur die Um- 


AMR 


Adaptive Multi-Rate 




leitung eines abzufangenden Medienstroms uber 


AMR-WB 


AMR-Wideband 




ein Zwischenspeichermedium einzurichten. 


DTMF 


Dual-Tone Multi-Frequency 






FEC 


Forward Error Correction 


10 




H248 


ITU standard 




Revendications 


H261 


ITU standard 






H320 


ITU standard 




1. Dispositif d'interception licite comprenant un ser- 


H323 


ITU standard 




veur mandataire de protocole de lancement de ses- 


IETF 


Internet Engineering Task Force 


15 


sion ou un controleur de passerelle de media adap- 


IP 


Internet Protocol 




tes pour detecter des informations dans les infor- 


ISDN 


Integrated Services Digital Network 




mations de signalisation etant transmises entre 


LDAP 


Lightweight Directory Access Protocol 




deux correspondants IP (protocole internet) et ca- 


MEGACO 


Media Gateway Controller 




racterise en ce qu'il est adapte pour generer des 


MCU 


Multipoint Control Unit 


20 


instructions parmi les informations de signalisation 


MPEG 


Motion Picture Expert Group 




de signalisation detectees pour donner pour ins- 


MGC 


Media Gateway Controller 




truction a un serveur mandataire de protocole de 


NGN 


Next Generation Network 




transport en temps reel de creer des voies pour con- 


PSTN 


Public Switched Telephone Network 




tourner un train de donnees de media a intercepter, 


PLMN 


Public Land Mobile Network 


25 


via un support de stockage intermediate. 


QoS 


Quality of Service 






RTCP 


Real-time Transport Control Protocol 






RTP 


Real-time Transport Protocol 






SDP 


Session Description Protocol 






SIP 


Session Initiation Protocol 
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TCP 


Transmission Control Protocol 






UAC 


User Agent Client 






UDP 


User Datagram Protocol 






UMTS 


Universal Mobile Transmission System 






VoIP 


Voice over IP 
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XML 


extensible Markup Language 







Claims 

40 

1. Lawful interception device including a Session Ini- 
tiation Protocol proxy server or a Media Gateway 
Controller adapted to detect information in the sig- 
nalling information being transmitted between two 
Internet Protocol parties and characterised by be- 45 
ing adapted to generate instructions out of the de- 
tected signalling information for instructing a Real- 
time Transport Protocol proxy server to create 
channels to bypass a media stream to be intercept- 
ed via an intermediate storage medium. 50 

Patentanspriiche 

1. Legale Abfangeinrichtung miteinem Session-lnitia- 55 
tion-Protocol-Proxy-Server oder einer Medien-Ga- 
teway-Steuerung, der bzw. die geeignet ist, Infor- 
mationen in der zwischen zwei Internet-Protokoll- 
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